On (25/03/15 14:35), Pavel Reichl wrote:
On 03/25/2015 02:21 PM, Lukas Slebodnik wrote:
>On (25/03/15 14:05), Pavel Reichl wrote:
>>
>>On 03/25/2015 01:51 PM, Lukas Slebodnik wrote:
>>>On (25/03/15 12:01), Pavel Reichl wrote:
>>>>Hello please see attached patch.
>>>>
>>>>The need for this patch was discussed in thread: SDAP: Lock out ssh keys
when
>>>>account naturally expires
>>>>This patch implements point number 3.
>>>>
>>>>>>I would prefer if we didn't add a new option as well, but
since we
>>>>>>released
>>>>>>a version that only supported the lockout and not any other
semantics,
>>>>>>I don't think we can get away with just changing the
functionality. A
>>>>>>minor version can break functionality. But a major version can
>>>>>>
>>>>>>So I propose the following:
>>>>>>1) Add a new value for ldap_access_order called
"ppolicy" that would
>>>>>>evaluate the pwdAccountLockedTime fully, including the new
>>>>>>functionality in this patchset
>>>>>>2) In 1.12, deprecate the "lockout" option and log a
warning that it
>>>>>>will be removed in future relase and users should migrate to
"ppolicy"
>>>>>>option
>>>The feature was introduced in sssd-1.12.1 and deprecated in sssd-1.12.5
>>>That's really fast progres. The deprecating the features
>>>after half a year.
>>>
>>>Could someone exaplain me why do we need to do such ritual dances?
>>>
>>>LS
>>First there was user ho wanted lockout functionality that is being dropped
>>now.
https://fedorahosted.org/sssd/ticket/2364
>>
>>Then a few months later there came another user with
>>https://fedorahosted.org/sssd/ticket/2534 who wished to do something similar
>>but different.
>>
I checked bugzilla tickets and the same user requested both features.
>>We think that user case addressed in 1st ticket can be handled
by
>>functionality introduced for 2nd ticket.
>>
>I mentioned it as a part of review a month ago.
>So you needn't explain it to me.
I'm sorry then.
>
>>So we decided to drop functionality for the first patch. Is it clear now?
>>
>The only think which I do not understand is why do we need to drop it know
>and it could not be part of ticket #2534
It is my understanding we could not drop the functionality in 1.12 - as there
are users who use it - so we needed to keep both.
But I think you are right that we could drop it in master as part of #2534.
Might be you remember that we were on tight schedule then and we simply
forget to this extra work for master.
Now QE reminded us a created a BZ.
BZ1205604 says:
Expected results:
Only ppolicy works since it is stricter than lockout
So your patch is wrong and we need to drop functionality even in 1.12
NACK
LS